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Abstract 

So far all the proven unconditionally secure prepare and measure protocols 
for the quantum key distribution(QKD) must solve the very complex prob- 
lem of decoding the classical CSS code. In the decoding stage, Bob has to 
compare his string with an exponentially large number of all the strings in 
certain code space to find out the closest one. Here we have spotted that, 
in an entanglement purification protocol(EPP), the random basis in the state 
preparation stage is only necessary to those check qubits, but uncessary to the 
code qubits. In our modified two way communication EPP(2-EPP) protocol, 
Alice and Bob may first take all the parity checks on Z basis to reduce the 
bit flip error to strictly zero with a high probability, e.g., 1 — 2 -30 , and then 
use the CSS code to obtain the final key. We show that, this type of 2-EPP 
protocol can be reduced to an equivalent prepare and measure protocol. In 
our protocol, the huge complexity of decoding the classical CSS code is totally 
removed. 
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Due to the Hesenberg uncertain principle, quantum key distribution is different from classical 
cryptography in that an unknown quantum state is in principle not known to Eve unless 
it is disturbed, rather than the conjectured difficulty of computing certain functions. The 
first published protocol, proposed in 1984 [1], is called BB84 after its inventors (C. H. 
Bennett and G. Brassard.) For a history of the subject, one may see e.g. 0. In this 
protocol, the participants (Alice and Bob) wish to agree on a secret key about which no 
eavesdropper (Eve) can obtain significant information. Alice sends each bit of the secret 
key in one of a set of conjugate bases which Eve does not know, and this key is protected 
by the impossibility of measuring the state of a quantum system simultaneously in two 
conjugate bases. Since then, studies on QKD are extensive. In particular, the strict proof on 
the unconditional security have abstracted much attentions. The original papers proposing 
quantum key distribution |JJ proved it secure against certain attacks, including those feasible 
using current experimental techniques. However, for many years, it was not rigorously proven 
secure against an adversary able to perform any physical operation permitted by quantum 
mechanics. 

The first general although rather complex proof of unconditional security was given by 
Mayers [^], which was followed by a number of other proofs Building on the quantum 

privacy amplification idea of Deutsch et al. f|, Lo and Chau proposed a conceptually 
simpler proof of security. This protocol, although has a drawback of requiring a quantum 
computer, opens the possibility of finding simple proofs on a prepare and measure protocol. 
Later on, Shor and Preskill || unified the techniques in || and and provided a simple 
proof of security of standard BB84. (See also || for a detailed exposition of this proof.) Shor- 
Preskill's proof is a reduction from the purification scheme to the quantum error correction 
with CSS code ]I0[ and finally to the BB84 scheme of decoding the classical CSS code 



with one way classical communication. Very recently, movivated for higher bit error rate 
tolerance and higher efficiency, Gottesman and Lo JTTJ] studied the two way communication 



entanglement purification protocol(2-EPP) and proposed a 4 state prepare and measure 
protocol with the highest bit error tolerance among all modified BB84 protocols so far. They 



also significantly increased the previous bit error tolerance rate for the six state protocol. 
The tolerable bit error rate for six state protocol is then further improved by Chau ||12|| . 
A general theorem on the sufficient condition to convert a 2-EPP protocol to a classical 



one is also given in [[LI]]. However, it has not been studied there on how to remove the 
complexity of decoding the CSS code in their prepare and measure protocol. So far in all 
those protocols based on CSS code, in the decoding stage, Bob has to compare his string 
with an exponentially large number of all the strings in certain code space to find out the one 
with the shortest distance with his string. The complexity of such a comparison can be huge 
without any preshared secrect string. For example, if we try to distill a final key of 300 bits, 
the complexity will be far beyond the power of any exisiting classical computer. Studies 
towards the removal of the decoding complexity are rare. To the best of our knowledge 
the only report on this topic is given by H.K. Lo ||13|| . However, Lo's scheme requires that 
Alice and Bob have a pre-shared secrect string. Here we take a further study on the 2- 
EPP QKD [[II] and we find that besides the advantage of a higher bit error tolerance as 
reported in [|11|| , the 2-EPP protocol has another advantage, it can be used to remove the 
huge complexity in decoding the classical CSS code. We will construct a specific prepare 
and measure protocol without the decoding complexity. That means, in our protocol, even 
a large classical computer is unnecessary. Before going into details of our protocol, we first 
make some mathematical notations and some background presumptions for the quantum 
key distribution. 

We will use two level quantum states as our qubits. For example, spin half particles 
or linearly polarized photons. A quantum state can be prepared or measured in different 
basis. We define the spin up, down or polarization of horizontal, vertical as the Z basis, 
i.e., the basis of {|0), |1)}. We define the spin right, left or polarization of 7r/4,37r/4 as the 
X basis, i.e., the basis of {|+), |— )}• These basis are related by |+) = ^(|0) + |1)) and 

l-) = ^(|o>-|i». 

There are four maximally entangled states(Bell basis) 
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*± = i=(|01>±|10», $ ± = i=(|00)±|ll)), 

which form an orthonormal basis for the quantum state space of two qubits. 
There are three Pauli matrices: 
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The matrix a x applies a bit flip error to a qubit, while a z applies a phase flip error. We 
denote the Pauli matrix o a acting on the Z'th bit of the CSS code by a a m for a G {x, y, z}. 
For a binary vector 7, we let 

where er° is the identity matrix and 7, is the i'th bit of 7. The matrices ap (c| s l) have all 
eigenvalues ±1. 

We also need a short review the properties of CSS code [|Kj]. Here we directly borrow 
the review materials given in ref . || . Quantum error-correcting codes are subspaces of the 
Hilbert space C 2 " which are protected from errors in a small number of these qubits, so that 
any such error can be measured and subsequently corrected without disturbing the encoded 
state. A quantum CSS code Q on n qubits comes from two binary codes on n bits, C\ and 
C*2, one contained in the other: 

{0} C C 2 C d C Fl 



where is the binary vector space on n bits ||10|| . 

A set of basis states (which we call codewords) for the CSS code subspace can be obtained 
from vectors v G C\ as follows: 
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If v 1 — t>2 G C2, then the codewords corresponding to v\ and V2 are the same. Hence 
these codewords correspond to cosets of C 2 in Ci, and this code protects a Hilbert space 



of dimension 2 dimC,1_dim(:72 . Moreover, there is a class of quantum error correcting codes 
equivalent to Q, and parameterized by two n-bit binary vectors x and z. Suppose that Q is 
determined as above by C\ and C*2. Then Q XjZ has basis vectors indexed by cosets of C2 in 
Ci, and for v G C±, the corresponding codeword is 

v — = 177^ E + v + w). (2) 

We now make some presumptions. Without any loss of generality, we assume a Pauli channel 
between Alice and Bob. All Eve's action can be regarded as (part of) channel noise. A pauli 
channel is a channel acts independently on each qubit by the Pauli matrices with classical 
probability. We shall only consider two independent errors which are a x error(bit flip error) 
and <j z (phase flip) error. All a y error can be regarded as the joint error of a x and a z . 
Although the channel is noisy, we assume all qubits stored by Alice are never corrupted. 
Moreover, we assume the classical communication between Alice and Bob is noiseless. 

We start from recalling Lo and Chau's protocol |7| based on the entanglement purification 
rjj. Suppose initially Alice and Bob share some impure EPR pairs. They randomly select 



a subset of them to check the bit flip error rate and the phase flip error rate. They then 
distill a small number of almost perfect EPR pairs from the remained pairs. They obtain 
the final key by measuring them in each side in Z basis. Note that here the only thing that 
is important is to distill some almost perfect EPR pairs, it does not matter on how Alice 
prepares the initial state. Actually, the random Hadamard transform on the code qubits 
in Shor-Preskill protocol is uncessary. Note that every qubit in transmission has the same 
density operator. In intercepting the qubits from Alice, Eve has neither classical information 
nor quantum information to distinguish which ones are check bits and which ones are code 
bits. Eve cannot treat them differently. Therefore the bit flip error rate and the phase flip 
error rate in the code bits must be close to that in the check bits, given a large number 
of check bits and code bits. All these properties are not unchanged no matter whether 
Alice takes random Hadamard transformation to the code bits which are sent to Bob. We 
therefore have the following modified Lo-Chau-Shor-Preskill scheme: 



Protocol 1: Modified Lo-Chau-Shor-Preskill protocol 

1: Alice creates 2n EPR pairs in the state ($+)® r \ 

2: Alice sends the second half of each EPR pair to Bob. 

3: Bob receives the qubits and publicly announces this fact. 

4: Alice selects n of the 2n encoded EPR pairs to serve as check bits to test for Eve's 
interference. In using the check bits, she just randomly chooses the Z or X basis to 
measure and tells Bob does the same measurement to his halves on the same basis. 
They compare the measurement result on each check qubits. If too many of these 
measurements outcomes disagree, they abort the protocol. 

5: Alice and Bob make the measurements on their code qubits of aP for each row r £ Hi 
and 0\jjT' for each row r e Hi- Alice and Bob share the results, compute the syndromes 
for bit and phase flips, and then transform their state so as to obtain some nearly 
perfect EPR pairs. 

6: Alice and Bob measure the EPR pairs in the |0), |1) basis to obtain a shared secret 
key. 

Different from that in ||, here Alice does not take any random Hadamard transform to the 
code qubits sent to Bob. Actually, step 5 can be replaced by a two way communication 
purification scheme satisfying certain restrictions JllJ. Morever, it can be divided into two 
steps, i.e., correcting all the bit flip error first and then correcting the phase flip errors. 
Now we show how to correct all bit flip errors. We shall call a purification protocol using 
the above two steps as the extremely unsymmetric protocol in comparison with the normal 
protocols correcting bit flips and phase flips alternatively. This includes two stages: 
1. Crude bit flip error correction correction: Sharing a large number ( say, n) of 
imperfect EPR pairs with known upper bound of bit flip error rate, Alice and Bob may just 
randomly pick out two pairs( j and k) and compare the parity. More specifically, they take 
a controlled- not operation U c on each side (they use qubit j as the control qubit and qubit 
k as the target qubit). They each meassure the target bit, k in Z basis and compare the 
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value (see figure 1). U c here is denned as 

U c \xj, Xk) — \xj,Xj © Xk) (3) 

where \xj,Xk) is any possible quantum state for qubits j and k, expressed in Z basis. If 
the values on each side are same, they drop the target qubit k and keep the control qubit 
in a new set d\. If the values are different, they drop both qubits. They then randomly 
pick out another two pairs from the remained n — 2 pairs and check the parity again by the 
controlled-not gate and measurement on the target qubits in Z basis in each side. They can 
repeatedly do so until they have picked out all n imperfect pairs. If the original bit error 
rate for the n imperfect pairs is e^, the new bit error rate in the set di is now reduced to a 
little bit higher than e\. They can take the same parity check action to the qubits in the 
new set d\. They can take the similar action iteratively until they believe that the bit flip 
error rate in the remained qubits have been decreased to a very small value, e.g., 10~ 3 (or 
10~ 4 ). They then divide their qubits into a number of subset {Si}, e.g., each subset includes 
100 ( or 1000 ) qubits. There must be some subsets where the bit flip errors have been all 
corrected. Now they have to find out those subsets whose bit errors have been all corrected. 
2. Verification of zero bit flip error: The task now is to find out which subsets have 
been corrected perfectly on bit flip errors. We can use the verification scheme by asking 
the fair questions used in JjJ. Lets consider an arbitrary subset S$. Suppose there are 
n s qubits in this subset. Zero bit flip error on this subset means that, if Alice and Bob 
meassured each of them in Z basis, they would share a common string Sj = SiA = Sis- 
Here SiA and SiB are the strings for bit values at Alice's side and Bob's side, respectively. 
Suppose they each had meassured their qubits of Si. To verify SiA = SiB is equivalent to 
verify that s i0 = SiA © s iB = r , where r is a string with all elements 1. i.e. r = 111 • • • 1 
and SiB = r o © s iB =• To verify a classical tring s i0 = r , Alice may generate m random 
strings {Ri} in the same length with Sio, where each bit value in the random strings {Rj} 
are determined by a coin tossing. One can calculate the value s^ ■ Rj. If all Ri satisfies 

s i0 - R j (mod2) = P(R j ) (4) 
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s i0 must be identical to r with a probability 1 — 2~ m . Here P(Ri) is the parity of string i?,. 
In our EPP protocol, we have to verify that there is no bit flip error for the n s pairs in the 
subset {Si}. It is easy to see that 

s i0 ■ Rj(mod2) = (siA • Rj © Sis • Rj © r o • Rj) (mod2). (5) 

Therefore the condition that Sio ■ Rj{mod2) = P(Rj) is equivalent to 

SiA ■ Rj(mod2) = Sib • Rj(mod2), (6) 

where we have used the fact that r • Rj(mod2) = P(Rj). To verify the above formula, Alice 
and Bob actually need not measure each of the qubits in Z basis. As we are showing now, 
they can first take the controlled not operations in each side and gather the information 
of SiA ■ Rj(mod2) and SiB • Rj(mod2) to one qubit in each side therefore the measurement 
is only done on one qubit in each side. Alice may first create m classical random string 
{Rj} and announce them. The length of Rj are n s , n s — 1 • • • n s — m respectively. They 
first use the random string R 1 . Suppose all those bits in R 1 with bit value 1 are on the 
position pi,p2 ■ ■ ■ Pk (normally k is around n s /2), Alice and Bob each do a controlled unitary 
transformation U' c on qubits at the position Pi,P2 ■ ■ ■ Pk m Sj. They use qubit pk in each 
side as the target qubit (see figure(2)). The unitary operator U' c is defined by 

U c \Xp! , Xp 2 ' ' ' %p k ) \%pi 1 %P2 ' ' ' -Epk—ll %p k ) • (7) 

and 

k 

x ' Pk = H x vr (8) 

Here \x pi ,x P2 ■ ■ -x Pk ) is a quantum state in Z <g> Z ■ ■ ■ Z basis. Unitary transformation U' c 
replaces the state of kth qubit by the parity of all the qubits of p±,P2 • • • Pk m Z basis and 
keep all other qubits unchenged. Alice and Bob then measure the qubit at the position pu in 
each side in Z basis. The outcomes are just SiA • Rj(mod2) and SiB ■ Rj(mod2), respectively. 
If they are different, they discard all qubits which are originally in Si. If they are identical, 
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they discard qubit pu in Si and change the qubit index I into 1 — 1 for any I > pk in Si. Now 
the qubit index is from 1 to n s — 1. They use random string i? 2 to redo the similar operation 
as that with string R\. They take the operations repeatedly until they have exausted all Rj 
(or discard all qubits which are originally in Sj whenever they find the values of the target 
bits in the two sides are different). If the target bit values in two sides are always identical, 
they accept the remained n s — m qubits in subset Si. Now the probability of no bit flip error 
for the survived qubits in Si is 1 — 2~ m . Suppose after the crude bit flip error correction the 
bit flip error is eg and n s eg << 1, the probability of discarding Si is a little bit larger than 
n s e%(l — el) ns ~ l after the verification stage. Note that after this bit flip error correction, the 
phase flip error for the remained qubits is increased. We denote the new phase error rate 
by e' . Suppose before any error correction, the bit flip error rate is e& and the phase flip 
error rate is e p and the joint error (cr,, type error) rate is e&p. The prior probability for a 
qubit carrying a phase flip error but no bit flip error is e p — e& p . After all bit flip errors are 
corrected(i.e., allr qubits carrying only a bit flip error and all qubits carrying both errors 
are removed), the post probability for a qubit carrying a phase flip error is 

Obviously, the worst case e& p = leads to the highest value of e' p . Therefore the upper bound 
for the new phase flip error rate after the bit flip error correction is 

- ^ (9) 



P l~e b 

Note that once all bit flip errors are corrected, the bit flip error will not increase any more 
by the subsequent phase flip error correction. Protocol 1 is now reduced to the following 
protocol 

Protocol 2: Extremely unsymmetric distillation protocol 

1: Alice creates 2n EPR pairs in the state ($ + ) cg,n . 

2: Alice sends the second half of each EPR pair to Bob. 

3: Bob receives the qubits and publicly announces this fact. 



4: Alice selects n of the 2n encoded EPR pairs to serve as check bits to test for Eve's 
interference. In using the check bits, she just randomly chooses the Z or X basis to 
measure and tells Bob does the same measurement to his halves on the same basis. 
They compare the measurement result on each check qubits. They find the detected 
bit flip error rate is e& and the phase flip error rate is e p . If these values exceed certain 
threshold set in advance, they abort the protocol. 

5: Alice and Bob first use the crude bit flip error correction to reduce the bit flip error rate 
to el and then divide the remained qubits into q subsets, suppose there are n s qubits 
in each subset. They then use the veryfication of zero bit flip scheme as described 
above to distill a number of qubits where bit flip error is zero. Suppose g subsets have 
passed the verification, Alice and Bob is now sharing g(n s — m) qubits whose bit flip 
error rate is strictly with a probability of 1 — g ■ 2~ m and phase flip error rate is e' p . 

6: Alice and Bob make the measurements on their code qubits of op for each row r e Hi 
and (jM for each row r e H 2 . Alice and Bob share the results, compute the syndromes 
for bit and phase flips, and then transform their state so as to obtain m nearly perfect 
EPR pairs. 

7: Alice and Bob measure the EPR pairs in the |0), |1) basis to obtain a shared secret 
key. 



Protocol 2 is a CSS like protocol [11]. In particular, all operations including the controlled 



unitary transformations and measurements in step 5 only are done only in Z basis therefore 



the protocol satisfies the main theorem in [11]. Consequently, this protocol can be converted 



to the prepare and measure protocol, i.e. BB84 protocol. 

In particular, using the arguments in Ref . || , step 6 and 7 in protocol 2 can be reduced to 
the encoding and decoding of quantum CSS code and can be further reduced to a prepare and 
measure protocol followed by decoding a CSS code with one way classical communication. 
Step 6 and 7 are equivalent to the case that Alice starts with g(n s — m) perfect EPR pairs 
and send the second halves to Bob through an unsymmetric noisy channel causing no bit 
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flip error and a phase flip error rate bounded by e' p . After Bob received the qubits from 
Alice they meassure the syndromes and then distill a small number of perfect EPR pairs. 
As argued in Ref. |J, such a process is equivalent to the process that Alice meassures each 
of her qubits in Z basis at any time and then Alice and Bob obtain the final key by decoding 
a classical CSS code with one way classical communication. Specifically, step 6 and step 7 
are equivalent to the following steps: 

6': Alice measures all her qubits in Z basis and obtain a g(n s — m)— bit state \x). She 
randomly pick out a binary vector v in code space C\. She sends the binary classical string 
x + v to Bob. 

7': Bob measures his qubits in Z basis and obtain \x) which is exactly identical to Alice's 
measurement outcome with a probability 1 — g • 2~ m . With such a high probability that his 
state is identical to Alice's, he simply always assumes that there is no deviation between his 
measurement result and Alice's result. Using the information x + v from Alice, he has a new 
string v in code space C\. 

8: Alice and Bob use the coset of v + Ci as their final key. 

Prior to step 6', all bit flip error had been removed, we only require our CSS code used there 
to correct e' p phase flip error and bit flip error. Therefore we can safely set dim{C\) = 
g(n s — m) in the CSS code. 

Furthermore, step 5 is now followed immediately by Alice's measurement in Z basis to all of 
her qubits. Since all operations in step 5 are in Z basis, we can change the order of all these 
operations. In particular, Alice may choose to meassure all of her qubits in the begining 
of step 5. This is equivalent to take measurement in Z basis to all her code qubits in the 
begining of the whole protocol. If she does so, The controlled unitary transformation and 
all the parity checks can be done classically as the following: 

1. Classical crude bit flip error correction correction: Bob measures all his code 
qubits in Z basis and obtain a classical string s. Alice and Bob randomly pick out two 
bits^j, Xk) in the string and compare parity. If the values on each side are same, they drop 
Xk and keep Xj in a new set d±. If the values are different, they drop both bits. They then 
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randomly pick out another two bits from the remained n — 2 bits in string s and check the 
parity. If the parity is same, they drop one and place another one in set d\. If the parity is 
different, they drop both bits. They can repeatedly do so until they have picked out all bits 
in string s. If the original bit error rate in string s is €b, the new bit error rate in the set 
d\ is now reduced to a little bit higher than e\. They can take the same parity check action 
to the bits in the new set d\ and place all distilled bits in another set c?2- They can take 
the similar action iteratively until they believe that the bit flip error rate in the remained 
bits have been decreased to a very small value, e.g., 10~ 3 ( or 1CT 4 ). They then divide their 
bits into a number of substrings {Si}, e.g., each substring includes 100 bits (or 1000 bits). 
There must be some substrings where the bit flip errors have been all corrected. Now they 
start to find out those substrings whose bit flip errors have been all corrected. 
2. Classical verification of zero bit flip error: Lets consider substring Si. Suppose 
there are n s bits in this substring. Suppose SiA and SiB are the classical strings at Alice's side 
and Bob's side, respectively. Alice creates m classical random string {Rj} and announces 
them. The length of R\, R2 ■ ■ ■ R m are n s , n s — 1 • • -n s — m, respectively. They first use the 
random string R±. Suppose the last non-zero bit in Ri is at position p k . They each calculate 
the value SiA • Rl(mod2) and Sis ■ R\(mod2) respectively. If they get the same result, they 
discard bit pk in Si and keep all the others and change the bit index of / into I — 1 for any 
/ > pk in Si. Now there are only n s — 1 bits remained in string Si. If they get a different 
result, they discard the whole Si. They take the operation repeatedly until they exaust all 
Rj (or discard Si once the have got the different value). If SiA • Rj(mod2) = SiB • Rj(mod2) 
for all Rj, they accept the remaining n s — m bits in substring S^ Now the probability of no 
bit flip error is 1 — 2~ m for the survived bits in Si. Suppose after the classical crude bit flip 
error correction the bit flip error rate is e£ and n s e c h << 1, the probability of discarding Si 
is a little bit larger than n s e£(l — e£) ns_1 after the classical verification stage. There must 
be a significant number of substrings that can pass the classical verification check provided 
the total bit flip error rate is rather small after the classical crude bit flip error correction. 
Again, as it was argued in ||, Alice may also chooses to meassure all her check qubits 
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on Z basis in the begining of the protocol. If she does so, protocol 2 is equivalent to 
BB84 protocol, with a post selection on which ones are check qubits, which ones are 
code qubits and which ones are qubits measured in wrong basis which should be dis- 
carded immediately. Therefor we have the following final prepare and measure protocol: 

Protocol 3: Simplified BB84 

1: Alice generates a classical set W = {1, 2, 3, 4}. She randomly picks out one value from 
this set. If she gets 2,3 or 4, she prepares a state in basis (|0), |1)}. If she gets 1, she 
prepares a state in basis {|+), |— )}. Alice creates (4 + S)n states in this way. 

2: Alice sends the resulting qubits to Bob. 

3: Bob receives the (4 + 8)n qubits, measuring each of them in a basis randomly chosen 

from X, Z by a coin tossing. 
4: Alice announces the basis information for each qubit. 

5: Bob discards any results where he measured in a different basis than Alice prepared. 
With high probability, there are at least 2n bits left (if not, abort the protocol). Bob 
chooses all those remained qubits measured in the |+),|— ) basis and randomly chooses 
the same number of qubits measured in Z basis as the check bits. They discard a few 
qubits and use the rest n qubits as the code bits. 

6: Alice and Bob announce the values of their check bits. If too few of these values agree, 
they abort the protocol. They find the bit flip error rate and the phase flip error rate 
on the checked bits are and e p respectively. 

7: They use the classical crude bit flip error correction scheme and the classical verification 
of zero bit flip error scheme to distill g(n s — m) bits. There are strictly no bit flip error 
for these g{n s — m) bits with a probability 1 — g • 2~ m . The new phase flip error is 
bounded by e\ = e' p + rj with a probability larger than 1 — exp(— \rfn/ (e p — e^)). 

8: Alice announces x + v, where x is a g(n s — m)— bit binary string consisting of the 
measurement outcome for the remaining bits, and v is a random binary string of 
g(n s — m) bits. 



13 



9: Bob subtracts x + v from his code qubits, x, and obtains v. 
10: Alice and Bob use the coset of v + C 2 as the final key. 

This is a modified BB84 protocol. Here Bob measures all the code bits in Z basis instead 
of in the random basis Z or X used in the original BB84. In using the above protocol, the 
suceeding probability is larger than (1 — 2~ m g)[l — exp(—jr] 2 n/(e p — e 2 ))]. In making the 
crude error correction to bit flip error, the number of qubits in set d\ will be less than n/2, 
that in <i 2 will be less than n/4. The method of crude distillation plus verification is not 
necessarily the most efficient one. It should be interesting to find out the most efficient 
scheme to make the quantum key distribution without classical complexity. 

In summary, we have spotted that the random Hadamard transformation on the code 
qubits sent to Bob is unnecessary in Alice's state preparation in an EPP protocol for quantum 
key distribution. Based on this fact, we have taken a further study on the 2-EPP QKD 
protocol and we have constructed a prepare and measure QKD protocol where the bit filp 
correction and the phase flip error correction(privacy amplification) is totally decoupled 
therefore the complexity of CSS code decoding is totally avoided. 
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Alice' s operation Bob's operation 

FIG. 1. Controlled not operation used for the crude bit flip error correction. The horizontal 

lines marked by j and k are qubit j and k respectively. Alice and Bob compare the measurement 

outcomes of the target qubit k. 
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Alice's operations Bob's operations 

FIG. 2. Controlled unitary operation used for the verification of zero bit flip error. The horizon- 
tal lines marked by piS are qubits at positioners in set Sj. Alice and Bob compare the measurement 
outcomes of the target qubit p^ . 
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